CVE-2024-42459: elliptic · Improper Verification of Cryptographic Signature
Affects ellipticSource CVE Database V5
Not known to be exploited · CVSS 5.3 Medium.
Data as of 26 Oct 2026, 13:47 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 22% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 2 Aug 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
npmellipticpkg:npm/ellipticOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
To mitigate CVE-2024-42459, organizations should: 1) Monitor the Elliptic package repository and security advisories for official patches and apply updates promptly once available. 2) Implement additional signature validation logic to enforce strict signature length checks and reject signatures with unexpected zero-valued byte modifications. 3) Conduct code audits and dependency reviews to identify and isolate usage of the vulnerable Elliptic version in Node.js applications. 4) Employ cryptographic best practices such as using alternative, well-maintained cryptographic libraries if immediate patching is not feasible. 5) Enhance monitoring and anomaly detection to identify suspicious signature-related activities or replay attempts. 6) Educate development teams about the risks of signature malleability and encourage secure coding practices around cryptographic operations. 7) For blockchain or transaction-based systems, consider implementing additional transaction validation layers to detect signature inconsistencies. These steps go beyond generic advice by focusing on proactive detection, layered defenses, and temporary workarounds until official patches are released.
Description
In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended.